7

CVE-2017-14798

local privilege escalation in SUSE postgresql init script

A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Postgresql ≫ Postgresql Version < 9.4-0.5.3.1
Suse ≫ Suse Linux Enterprise Server Version 11 Update sp3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1% 0.594
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7 1 5.9
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
OpenText 7.3 1.3 5.9
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

CWE-61 UNIX Symbolic Link (Symlink) Following

The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

http://lists.suse.com/pipermail/sle-security-updates/2017-November/003420.html
https://bugzilla.suse.com/show_bug.cgi?id=1062722
https://www.exploit-db.com/exploits/45184/
https://www.suse.com/de-de/security/cve/CVE-2017-14798/